Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 17:46
General
- Target 2026-04-18_3683e1ba8983e3cfcd4ee9a28050a73f_elex_goldeneye_wannacry.exe
- Size 408KB
- Sample260418-wckppads4x
- SHA256 1f21730ddfad34bebb6b06472cada73803e270a375f1ae5a790a615121a5b8a0
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_3683e1ba8983e3cfcd4ee9a28050a73f_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3683e1ba8983e3cfcd4ee9a28050a73f_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{450CB34E-147F-4f9d-8700-565055A32931}.exeC:\Windows\{450CB34E-147F-4f9d-8700-565055A32931}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{528DD8D8-1131-49a8-AF40-5E8160C55397}.exeC:\Windows\{528DD8D8-1131-49a8-AF40-5E8160C55397}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31A8E244-41E4-4189-86F8-3EE4AAD93208}.exeC:\Windows\{31A8E244-41E4-4189-86F8-3EE4AAD93208}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6D7FA9D-03BB-4e6e-AADA-E20E6B92FE02}.exeC:\Windows\{E6D7FA9D-03BB-4e6e-AADA-E20E6B92FE02}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{475509DD-1140-4390-B044-D3FB01F01B03}.exeC:\Windows\{475509DD-1140-4390-B044-D3FB01F01B03}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C9A36FC-0037-4d0c-8594-5B55092A0466}.exeC:\Windows\{0C9A36FC-0037-4d0c-8594-5B55092A0466}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DDA8D9DC-E952-4a5d-AB5A-2582649937B6}.exeC:\Windows\{DDA8D9DC-E952-4a5d-AB5A-2582649937B6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2234E263-E8EC-4552-B383-401389B27492}.exeC:\Windows\{2234E263-E8EC-4552-B383-401389B27492}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DB4149B-96E4-41e0-9166-771A61319B0A}.exeC:\Windows\{8DB4149B-96E4-41e0-9166-771A61319B0A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5ABDC64-52AF-43f6-ACD3-2442EDF83565}.exeC:\Windows\{F5ABDC64-52AF-43f6-ACD3-2442EDF83565}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36B12489-F7C9-425d-9829-A09CAC60B01A}.exeC:\Windows\{36B12489-F7C9-425d-9829-A09CAC60B01A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5ABD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DB41~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2234E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDA8D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C9A3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47550~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6D7F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31A8E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{528DD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{450CB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0C9A36FC-0037-4d0c-8594-5B55092A0466}.exe
{2234E263-E8EC-4552-B383-401389B27492}.exe
{31A8E244-41E4-4189-86F8-3EE4AAD93208}.exe
{36B12489-F7C9-425d-9829-A09CAC60B01A}.exe
{450CB34E-147F-4f9d-8700-565055A32931}.exe
{475509DD-1140-4390-B044-D3FB01F01B03}.exe
{528DD8D8-1131-49a8-AF40-5E8160C55397}.exe
{8DB4149B-96E4-41e0-9166-771A61319B0A}.exe
{DDA8D9DC-E952-4a5d-AB5A-2582649937B6}.exe
{E6D7FA9D-03BB-4e6e-AADA-E20E6B92FE02}.exe
{F5ABDC64-52AF-43f6-ACD3-2442EDF83565}.exe
memory/1072-42-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/1072-46-0x00000000009B0000-0x0000000000A2B000-memory.dmp
memory/2532-24-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2532-28-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2640-10-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/2640-6-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/3904-15-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/3904-12-0x00000000008D0000-0x000000000094B000-memory.dmp
memory/4492-58-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/4492-54-0x00000000009E0000-0x0000000000A5B000-memory.dmp
memory/5052-4-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/5052-0-0x00000000009C0000-0x0000000000A3B000-memory.dmp
memory/5076-60-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/5076-63-0x00000000008B0000-0x000000000092B000-memory.dmp
memory/5688-48-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/5688-52-0x0000000000680000-0x00000000006FB000-memory.dmp
memory/5788-40-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/5788-36-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/5960-22-0x00000000008E0000-0x000000000095B000-memory.dmp
memory/5960-18-0x00000000008E0000-0x000000000095B000-memory.dmp
memory/5996-34-0x00000000009D0000-0x0000000000A4B000-memory.dmp
memory/5996-30-0x00000000009D0000-0x0000000000A4B000-memory.dmp